[Flang] Execution error when merge intrinsic function is specified as an argument to merge intrinsic function and its component is referenced after the result is assigned to `entity-decl`

[ohno-fj]

Version of flang-new : 20.0.0(c2717a89b8437d041d532c7b2c535ca4f4b35872)/AArch64

When merge intrinsic function is specified as an argument to merge intrinsic function and its component is referenced after the result is assigned to entity-decl (w), segmentation fault occurs.
The above program is sngg735a_2221.f90

When merge intrinsic function is not specified as an argument to merge intrinsic function, execution succeeds.
The above program is sngg735a_2222.f90

The following are the test program, Flang-new, Gfortran and ifx compilation/execution result.

sngg735a_2221.f90:

subroutine s1
  type :: x
     integer, allocatable :: z(:)
  end type x
  TYPE(x) :: v(1),w(1)
  allocate(w(1)%z(1),source=1)
  allocate(v(1)%z(1),source=1)
  w= merge( merge(v, v, .true.), merge(v, v, .true.), .true.) ! ng
!  w= merge( v, v, .true.)                                     ! ok
  write(6,*) "w(1)%z(1) = ", w(1)%z(1)
!  if (w(1)%z(1)/=1 ) print *,101
end subroutine s1

program main
  call s1
  print *,'pass'
end program main

$ flang-new sngg735a_2221.f90; ./a.out
Segmentation fault (core dumped)
$

$ gfortran sngg735a_2221.f90; ./a.out
 w(1)%z(1) =            1
free(): double free detected in tcache 2

Program received signal SIGABRT: Process abort signal.

Backtrace for this error:
#0  0x4000177fa917 in ???
#1  0x4000177f99a7 in ???
#2  0x4000177c079f in ???
#3  0x400017a96274 in ???
#4  0x400017a80a2b in ???
#5  0x400017acfb07 in ???
#6  0x400017ad6d13 in ???
#7  0x400017ad8e3f in ???
#8  0x400f37 in ???
#9  0x400f7b in ???
#10  0x401007 in ???
#11  0x400017a84383 in ???
#12  0x400a9b in ???
Aborted (core dumped)
$

$ ifx sngg735a_2221.f90; ./a.out
 w(1)%z(1) =            1
 pass
$

sngg735a_2222.f90:

subroutine s1
  type :: x
     integer, allocatable :: z(:)
  end type x
  TYPE(x) :: v(1),w(1)
  allocate(w(1)%z(1),source=1)
  allocate(v(1)%z(1),source=1)
!  w= merge( merge(v, v, .true.), merge(v, v, .true.), .true.)  ! ng
  w= merge( v, v, .true.)                                      ! ok
  write(6,*) "w(1)%z(1) = ", w(1)%z(1)
!  if (w(1)%z(1)/=1 ) print *,101
end subroutine s1

program main
  call s1
  print *,'pass'
end program main

$ flang-new sngg735a_2222.f90; ./a.out
 w(1)%z(1) =  1
 pass
$

$ gfortran sngg735a_2222.f90; ./a.out
 w(1)%z(1) =            1
free(): double free detected in tcache 2

Program received signal SIGABRT: Process abort signal.

Backtrace for this error:
#0  0x40002f0da917 in ???
#1  0x40002f0d99a7 in ???
#2  0x40002f0a079f in ???
#3  0x40002f376274 in ???
#4  0x40002f360a2b in ???
#5  0x40002f3afb07 in ???
#6  0x40002f3b6d13 in ???
#7  0x40002f3b8e3f in ???
#8  0x400f9b in ???
#9  0x400fdf in ???
#10  0x40106b in ???
#11  0x40002f364383 in ???
#12  0x400a9b in ???
Aborted (core dumped)
$

$ ifx sngg735a_2222.f90; ./a.out
 w(1)%z(1) =            1
 pass
$

[jeanPerier]

#119219

[ceseo]

Fixed by #119219. Closing.